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AO 93 (SDNY Rev. 05/10) Search and Seizure Warrant 


United States District Court 

for the 

Southern District of New York 
In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case 

Three Electronic Devices, See Attachment A ^ 

) 

SEARCH AND SEIZURE WARRANT 

To: Any "author ized — -—- 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Southern District of _ New York _ 

(identify the person or describe the property to be searched and give its location)\ 

Three Electronic Devices, See Attachment A 

The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized)'. 

See Attachment A 

I find that the affidavit(s), or any recorded testimony, establish probable cause to search, and seize the person or 
property. / , /. 

YOU ARE COMMANDED to execute this warrant on or before /jf - ■ (fy - 

>■ 5 , ' (not to exceed 14 days) 

□ in the daytime 6:00 a.m. to 10 p.m. S?f at any time in the day or night as I find reasonable cause has been 

established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 



The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Clerk of the , Court. # 

y Upon its return, this warrant and inventory shou ld be filed under seal by the Clbrkof the Court. 


USMJ Initials 


Sf I find that immediate notification may have an adverse result listed ih 18 ,TLS .C. § 27OS (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to thd person who, or whose- property, will be 
searched or seized (check the appropriate box) Sffor 30 days (not to exceed $0), \ '' -fl v 

□until, the facts justifying, the later specific date of v 


Date and time issued: A/ ~~ $ 




Judge *s signdiuie 



7 ^ 


City and state: New York. NY 


Hon. Henry B. Pitman. U.S. Magistrate Judge 

Printed name and title 
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AO 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant • 
to the Court. 


Date; _ _ 

Executing officer’s signature 


Printed name and title 
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Attachment A 

I. Devices to be Searched 

The devices to be searched (the “Subject Devices”) are described as: 

a. Subject Device-1 : A black and red USB drive with a white label that says “Tracking 
#: 180208140208 ” 

b. Subject Device-2: A silver DVD with a white label that reads “Cohen — 

2018.03.07.” 

c. Subject Device-3: A white DVD labelled “2-28-18 Cohen SW Returns — Google 

__andl &l.” . . ... - ______ Jf 

1 

II. Review of ESI on the Subject Devices 

Law enforcement personnel (including, in addition to law enforcement officers and agents, 
and depending on the nature of the ESI and the status of the investigation and related proceedings, 
attorneys for the government, attorney support staff, agency personnel assisting the government in 
this investigation, interpreters, and outside vendors or technical experts under government control) 
are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and 
instrumentalities of one or more violations of 52 U.S.C. §§ 30116(a)(1)(A) and 30109(d)(l)(A)(l) 

(illegal campaign contributions) (the “Subject Offense”), as listed below: 

il 

a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their 

‘ 

I 

agents or legal representatives, including any nondisclosure agreements and related 

| 

documents, and any communications related to such agreements. 

b. Evidence of communications involving Michael Cohen, Donald Trump and/or 
agents or associates of the Trump Campaign about Stephanie Clifford or Karen 
McDougal, or payments to Stephanie Clifford or Karen McDougal. 

c. Evidence of communications with American Media, Inc., David Pecker, and/or 
Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, 

and/or Karen McDougal. ; 

d. Evidence relating to Cohen’s role in the Trump Campaign, and coordination or j 

consultation with the Trump Campaign. 
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e. Evidence of communications with Donald Trump and/or agents or associates of the 

| 

Trump Campaign about the Access Hollywood tape. 

f. Evidence relating to Cohen’s knowledge of the campaign finance laws, campaign 
contribution reporting requirements, and campaign contribution limits. 

g. Evidence indicating Michael Cohen’s intent with respect to the Subject Offense, 
including whether the payment to Clifford and any similar payments were made to 
influence the Presidential election. 


2 
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AO 106 (Rev. 06/09) Application for a Search Warrant 


United States District Court 


for the 

Southern District of 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 

Three Electronic Devices, See Attachment A 



Case No. 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
DroDertv to be searched and.eive.its locationlL. _ _ 

~TK«tt ^l-fc ■KC'ewvie- Devi'Cr^ 



ySee-Attachment-A- 


located in the 


Southern 


District of 


New York 


, there is now concealed (identify the 


person or describe the property to be seized)'. 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more)’. 
ivf evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

□ property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Offense Description 


Code Section 

52 USC 30116(a)(1 )(A), 30109 Illegal campaign contributions 
(d)(1)(A)(1) 


The application is based on these facts: 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. 

sf Continued on the attached sheet. 

sf Delayed notice of 30 days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet 


) is requested 


Sworn to before me and signed in my presence. 
Date: V- 

City and state: AJ_ 



' Judge’s signature 

Hon. Henry B. Pi tifian, U.S. Ma gi strate Judge 
.Printed riame and title 
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TO BE FILED UNDER SEAL 

Agent Affidavit in Support of 
Application for a Search Warrant 


Special Agent of the United States Attorney’s Office for the Southern 

District of New York (“USAO”)’being duly sworn, deposes and says: 

I. Introduction 
A. Affiant 

1. I have been a Special Agent with the US AO since August 2016. I previously served 
as a Special Agent with the United States Department of Labor Inspector General from May 2011 
to August 2016. In the course of my experience and training in these positions, I have participated 
in criminal investigations into federal offenses involving a wide array of financial crimes, 
including frauds on financial institutions, and have been involved in investigations involving 
violations of campaign fin ances laws and regulations. I also have training and experience 
executing search warrants, including those authorizing the search of email accounts and electronic 
devices. 

2. I make this Affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search the electronic devices specified below (the 
“Subject Devices”) for the items and information described in Attachment A. This affidavit is 
based upon my personal knowledge; my review of documents and other evidence; my 
conversations with other law enforcement personnel; and my training, experience and advice 
received concerning the use of computers in criminal activity and the forensic analysis of 


UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


hi the Matter of the Application of the United 
States Of America for a Search Warrant for Three 
Electronic Devices, USAO Reference No 
2018R00127 


SOUTHERN DISTRICT OF NEW YORK) ss.: 


2 
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electronically stored information (“ESI”). Because this affidavit is being submitted for the limited 
purpose of establishing probable cause, it does not include all the facts that I have learned during 
the course of my investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and in part, except where 
otherwise indicated. 

B. Prior Warrants and the Subject Devices 

3. The USAO and the Federal Bureau of Investigation (“FBI”) have been 
investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen 
is an attorney who currently holds himself out as the personal attorney for President Donald Trump, 
and who previously served for over a decade as an executive in the Trump Organization, an 
international conglomerate with real estate and other holdings. 

4. In connection with an investigation then being conducted by the Office of the 
Special Counsel (“SCO”), the FBI sought and obtained from the Honorable Beryl A. Howell, Chief 
United States District Judge for the District of Columbia, three search warrants for emails and 
other content information associated with two email accounts used by Cohen, and one search 
warrant for stored content associated with an iCloud account used by Cohen. Specifically: 

a. On or about July 18,2017, the FBI sought and obtained a search warrant for 

emails in the account Tgm.ail.com (the “Cohen Gmail Account”) sent or received 

between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17-mj-00503, is 
attached as Exhibit A (the “First Cohen Gmail Warrant”). 

b. On or about August 8, 2017, the FBI sought and obtained a search warrant 

for content stored in the iCloud account associated with Apple ID fTgmail.com (the 

“Cohen iCloud Account”). This warrant, which is numbered, 17-mj~00570, is attached as Exhibit 
D (the “Cohen iCloud Warrant”). 


3 
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c. On or about November 13, 2017, the FBI sought and obtained a search 
warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and 
November 13, 2017. This warrant, which is numbered 17-mj-00855, is attached as Exhibit B (the 
“Second Cohen Gmail Warrant”). 

d. On or about November 13, 2017, the FBI sought and obtained a search 

warrant for emails in the account | the “Cohen MDCPC Account”) sent or 

received between the opening of the Cohen MDCPC Account 1 and November 13, 2017. This 
warrant, which is numbered 17-mj-00854, is attached as Exhibit C (the “First Cohen MDCPC 
Warrant”). 

5. The SCO has since referred certain aspects of its investigation into Cohen to the 
US AO, which is worldng with the FBI’s New York Field Office. As part of that referral, on or 
about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other 
content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail 
Warrant, and Cohen MDCPC Warrant. On or about March 7, 2018, the SCO provided the USAO 
with all non-privileged content obtained pursuant to the Cohen iCloud Warrant. 2 A filter team 
working with the SCO had previously reviewed the content produced pursuant to these warrants 
for privilege. 

6. On or about February 28,2018, the USAO sought and obtained search warrants for 
emails in Cohen Gmail Account and Cohen MDCPC Account, among other accounts, sent or 

1 Based on my review of this warrant and the affidavit in support of it, I know that the warrant did 
not specify a time period, but the affidavit indicated that, pursuant to court order, the service 
provider had provided non-content information for the Cohen MDCPC Account that indicated that 
the account contained emails from the approximate period of March 2017 through the date of the 
warrant. 

2 The SCO had previously provided a subset of this non-privileged content on or about February 
2,2018. 


4 
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received between November 14, 2017 and February 28, 2018. These warrants, which are both 
numbered 18 Mag. 1696, are attached as Exhibits E (the “Third Cohen Gmail Warrant”) and F (the 
“Second Cohen MDCPC Warrant”), respectively. The content produced pursuant to these 
warrants is being reviewed for privilege by an SDNY fdter team. 

7. The search warrants described above are referred to collectively herein as the “Prior 
Warrants.” 

8. The returns of the Prior Warrants are presently contained on three electronic 
devices. In particular: 

a. Subject Device-1: The non-privileged emails and content returned in 
response to the First Cohen Gmail Warrant, the Second Cohen Gmail Warrant, and the First Cohen 
MDCPC Warrant are contained on Subject Device-1, which is particularly described as a black 
and red USB drive with a white label that says “Tracking #: 180208140208.” 

b. Subject Device-2: The non-privileged content returned in response to the 
Cohen iCloud Warrant is contained on Subject Device-2, which is particularly described as one 
silver DVD with a white label that reads “Cohen — 2018.03.07.” 

c. Subject Device-3: The content returned in response to the Third Cohen 
Gmail Warrant and the Second Cohen MDCPC Warrant is contained on Subject Device-3, which 
is particularly described as one white DVD labelled “2-28-18 Cohen SW Returns — Google and 
l&l.” 

9. The Subject Devices are presently located in the Southern District of New York. 

C. The Subject Offenses 

10. The affidavits in support of the Prior Warrants describe evidence of several 
different courses of conduct by Cohen, including, among other things, false statements to financial 

institutions relating to the purpose of an account he opened in the name of Essential Consultants 

5 
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LLC and the nature of funds flowing into that account; false statements and fraudulent omissions 
by Cohen in connection with this attempt to refinance his debts with certain financial institutions; 
and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without 
having registered as a foreign agent. The Prior Warrants accordingly define the evidence to be 
seized by reference to subject offenses and specific categories of information related to these 


cours.es of conduct. The subject offenses in the Prior Warrants are summarized as follows: 


Exhibit 

Warrant 

3 

Subject Offenses in Prior Warrant 

A 

First Cohen Gmail 

.18 U.S.C. §§371 (conspiracy to defraud the United States), 1005 (false 


Warrant 

bank entries), 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§ 611 etseq. (Foreign Agents 
Registration Act (“FARA”)) 

B 

Second Cohen Gmail 
Warrant 

18 U.S.C. §§ 371 (conspiracy to defraud the United States), 1005 (false 
bank entries), 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§611 etseq. (FARA) 

C 

Cohen MDCPC Warrant 

18 U.S.C. §§ 371 (conspiracy to defraud the United States), 1005 (false 
bank entries), 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§611 etseq. (FARA) 

D 

Cohen iCloud Warrant 

18 U.S.C. §§ 1014 (false statement to financial institution), 1344 (bank 
fraud), 1956 (money laundering), 951 (acting as an unregistered foreign 
agent), and22U.S.C. §§ 611 etseq. (FARA) 

E 

Third Cohen Gmail 
Warrant 

18 U.S.C. §§371 (conspiracy to commit offense or to defraud the United 
States), 1005 (false bank entries), 1014 (false statements to financial, 
institution), 1343 (wire fraud), 1344 (bank fraud) 

F 

Second Cohen MDCPC 
Warrant 

18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud the United 
States), 1005 (false bank entries), 1014 (false statements to financial 
institution), 1343 (wire fraud), 1344 (bank fraud) 


11. Based on my participation in this investigation, including my review of documents 
obtained pursuant to subpoena and court order, my conversations with witnesses and review of 
reports of conversations with witnesses, and my review of publicly available information, I have 


3 On or about February 28, 2018, the USAO sought and obtained a Rule 41 warrant, authorizing it 
to expand its search of the email returns for the warrants attached as Exhibits A-C (the First Cohen 
Gmail Warrant, Second Cohen Gmail Warrant, and First Cohen MDCPC Warrant) for additional 
offenses not authorized in the original warrants for those accounts. The below chart therefore lists 
both the subject offenses listed in the original warrants for these accounts and the subject offenses 
authorized in the February 28, 2018 warrant. 


6 
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learned of evidence of an additional Subject Offense committed by Cohen, described below, which 
was not listed in the Prior Warrants. 4 

12. I am therefore requesting authority to expand the search of the returns of the Prior 
Warrants, as contained on the Subject Devices, for evidence related to the additional Subject 
Offense. As set forth below, in addition to the categories of evidence already described in the 
Prior Warrants, there is probable cause to believe that the Subject Devices contain evidence of 
violations of 52 U.S.C. §§ 30116(a)(1)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) 
(the “Subject Offense”). 5 

II. Probable Cause Regarding the Subject Offense 

13. As set forth above, the USAO and the FBI have been investigating, among other 
things, a scheme by Michael Cohen to defraud multiple banks. During the course of this 
investigation, the USAO and FBI have obtained evidence that Cohen has also committed a criminal 
violation of the campaign finance laws by making an excessive in-kind contribution to the 
presidential election campaign of then-candidate Donald Trump in the form of a $ 130,000 payment 
to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with 
Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there 
is probable cause to believe that this payment was intended to keep Clifford from making public 
statements about the rumored affair on the eve of the 2016 presidential election, and thus 
constitutes a campaign contribution in excess of the applicable limit. 


4 As set forth below, I base this application in part on my review of emails and text messages 
obtained pursuant to the Prior Warrants. Each of the cited emails or texts messages is either 
responsive to the applicable Prior Warrant and/or was discovered in plain view during a review of 
the emails or texts returned pursuant to the applicable Prior Warrant. 

5 The Prior Warrants describe categories of information that likely encompass evidence of the 
additional Subject Offense. Nevertheless, in an abundance of caution, I am seeking explicit 
authorization to search the Subject Devices for evidence of the Subject Offense. 


7 
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14. From my review of public sources, I have learned the following: 

a. In or around October 2011, there were rumors published on the gossip websites 
TheDirty.com that Trump had had an extramarital affair with Clifford, an adult film actress whose 
screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life & Style 
Magazine, a tabloid sold in supermarkets, also published an article, based on the report in 
TheDirty.com, alleging an affair had occurred between Trump and Clifford. Both Trump and 
Clifford, through their representatives, issued denials in response to the articles. 

b. Specifically, on or about October 11,2011, Keith Davidson, who identified himself 
as Clifford’s attorney, sent a cease and desist letter to TheDirty.com, demanding that the article 
regarding Trump and Clifford be removed from the website. Additionally, on or about October 
12, 2011, Cohen, who was then Executive Vice-President and Special Counsel to the Trump 
Organization, stated to El News that “[t]he totally untrue and ridiculous story . . . emanated from 

a sleazy and disgusting website_The Tmmp Organization and Donald J. Trump will be bringing 

a lawsuit. . . [and] Mr. Trump and the Trump Organization would like to thank and commend 
Stormy Daniels and her attorneys for their honesty and swift actions.” 

15. On or about June 16, 2015, Trump formally launched his 2016 presidential 
campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee 
for president, and on July 19, 2016, Trump officially became the nominee. Based on my review 
of public sources, I have learned that while it does not appear that Cohen had an official title as 
part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of 
Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to 
defend Trump’s polling numbers. 


8 
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16. On or about October 7, 2016, The Washington Post published online a video and 
accompanying audio in which Trump referred to women in what the article described as “vulgar 
terms” in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The 
following day, on October 8, 2016, Trump appeared in a video in which he stated, among other 
things, “I’ve said and done things I regret and words released today on this more than a decade old 
video are one of them. Anyone who knows me knows these words don’t reflect who I am. I said 
it. I was wrong and I apologize.” Based on my review of public sources, I also know that 
representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood 
comment was an old and isolated incident. 

17. Based on my review of public sources, including an article published in Slate 
magazine by a reporter who interviewed Clifford, that around this same time, in or about October 
2016, Clifford was in discussions with ABC’s Good Morning America show and Slate magazine, 
among other media sources, to provide these media outlets with her statement about her alleged 
relationship with Trump. According to the article in Slate , which the author based on' 
conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for 
her story or be paid by Trump not to disclose her accusation. As .Cohen summarized in a 2018 
email obtained pursuant to the Cohen Email Warrants: “In October 2016, I was contacted by 
counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 
story of an alleged affair between Mr. Trump and Ms. Clifford.” 

18. From my review of telephone toll records 6 and information produced pursuant to 
the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access 

6 My attribution of certain telephone numbers to certain individuals as described in this 
affidavit is based on my review of the vCard (virtual contact file) obtained from Cohen’s telephone 
pursuant to the iCloud Warrant. 


9 
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Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith 
Davidson, who was then Clifford’s attorney, David Pecker and Dylan Howard of American Media, 
Inc. (“AMI”), the publisher of the National Enquirer , 7 Trump, and Hope Hicks, who was then 
press secretary for Trump’s presidential campaign. Based on the timing of these calls, and the 
content of the text messages and emails, I believe that at least some of these communications 
concerned the need to prevent Clifford from going public, particularly in the wake of the Access 
Hollywood story. In particular, I have learned the following: 

a. On October 8,2016, at approximately 7:20 p.m., Cohen received a call from Hicks. 
Sixteen seconds into the call, Tramp joined the call, and the call continued for over four minutes. 8 
Based on the toll records that the USAO has obtained to date, I believe that this was the first call 
Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke 
about once a month prior to this date - specifically, prior to this call on October 8, 2016, Cohen 
and Trump had spoken once in May, once in June, once in July, zero times in August, and twice 
in September. 

h. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for 
about two minutes. 


7 Pecker is President of AMI and, according to his own statements in public reports, a personal 
friend of Trump. Howard is the chief content officer of AMI, who according to public records 
reports directly to Pecker. 

8 1 believe that Tramp joined the call between Cohen and Hicks based on my review of toll 
records. Specifically, I kn ow that a call was ini tiated between Cohen’s telephone number and 
Trump’s telephone number at the same time the records indicate that Cohen was talking to Hicks. 
After the Cohen-Tramp call was initiated, it lasted the same period of time as the Cohen-Hicks 
call. Additionally, the toll records indicate a “-1” and then Tramp’s telephone number, which, 
based on my training and experience, means that the call was either transferred to Tramp, or that 
T ramp was added to the call as a conference or three-way call participant. In addition, based on 
my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, 
in substance, that to the best of her recollection, she did not learn about the allegations made by 
Clifford until early November 2016. Hicks was not specifically asked about this three-way call. 


10 
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c. At 7:39 p.m., immediately after the second call with Hicks ended, Cohen called 
David Pecker (as noted above, the President of Am erican Media Inc., or AMI) and they connected 
for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke 
for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call 
from Dylan Howard (as noted above, the Chief Content Officer of AMI), and they spoke for 
approximately a minute. According to toll records, it does not appear that Cohen and Howard 
spoke regularly prior to October 8, 2016, as it had been over a month since they had called each 
other. 

d. At 7:56 p.m., approximately eight minutes after his call with Howard ended, Cohen 
called Hicks and they connected for two minutes. At approximately the same time this call ended, 
Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 p.m., about 
three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly 
eight minutes. 

e. At 8:39 p.m. and 8:57 p.m., Cohen received calls from Howard and spoke to him 
for about four and six minutes, respectively. At 9:13 p.m., about ten minutes after Cohen and 
Howard hung up from the second of these calls, Howard sent Cohen a text message that said: 
“Keith will do it. Let’s reconvene tomorrow.” Based on my involvement in this investigation, I 
believe that when Howard wrote “Keith,” he was referring to Keith Davidson, the attorney for 
Stephanie Clifford. At 3:31 a.m., now on October 9, 2016, Cohen sent Howard a text message in 
response that said: “Thank you.” Eight minutes later, Cohen sent Howard a text message that said: 
“Resolution Consultants LLC. is the name of the entity I formed a week ago. Whenever you wake, 
please call my cell.” 


11 
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L 

f. The following day, on October 10,2016,. at 10:5 8 a.m., Howard sent a text message 
to Cohen and Davidson, which stated: “Keith/Michael: connecting you both in regards to that 
business opportunity. Spoke to the client this AM and they’re confirmed to proceed with the 
opportunity. Thanks. Dylan. Over to you two.” At 12:25 p.m., Davidson sent Cohen a text message 
that stated: “Michael — if we are ever going to close this deal — In my opinion, it needs to be today. 

Keith.” Davidson and Cohen then spoke by phone for about three minutes. Based on my 
participation in this investigation, I believe that when Howard wrote that the “client” was 
“confirmed to proceed with the opportunity,” he was referring to Clifford’s agreement in principle 
to accept money from Cohen in exchange for her agreement not to discuss any prior affair with 
then-candidate Trump. 9 

g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I 
kn ow that on or about October 10,2016, Clifford and Davidson appear to have signed a “side letter 
agreement” that stated it was an exhibit to a “confidential settlement agreement and mutual 
release” between “Peggy Peterson” and “David Dennison.” The purpose of the document, 
according to the agreement, was to define the “true name and identity” of persons named by 
pseudonym in “confidential settlement agreement and mutual release.” The side letter agreement 
specifies the identity of “Peggy Peterson” to be Clifford, but the space for “Dennison’s” identity 
is blank. The agreement also includes a signature page for “Peterson,” “Dennison,” and their 
attorneys. The signature page is signed by “Peterson” and his attorney, Davidson, but the 

9 As set forth below, AMI was also involved in a payment to model Karen McDougal. 

However, because these communications were in close temporal proximity to the events involving 
the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the 
payment of money to Clifford, I believe that these communications were related to Clifford. 

Additionally, based on my review of public statements by McDougal, I have learned that she 
negotiated an agreement with AMI several months prior to these communications between Cohen 
and Pecker, Howard, and Davidson. 
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document is unsigned by “Dennison” and his attorney. Based on my involvement in this 
investigation, I believe that Davidson sent Cohen this partially-signed “side letter agreement” in 
order to facilitate the closing of a deal between Davidson’s client and Cohen or his client on 
October 10, 2016. 

19. It appears that on October 13, 2016, and the days that followed, Cohen took steps 
to complete a transaction with Davidson, including attempting to open an account from which 
Cohen could transfer funds to Davidson. Specifically, from my review of toll records, information 
obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First 
Republic, as well as my participation in interviews with First Republic employees, I have learned 
the following: 

a. On the mo rnin g of October 13,2016, at 8:54 a.m., Cohen sent Pecker a text message 
that stated: “I need to talk to you.” At 9:06 a.m., Pecker sent a text message to Cohen that stated, 
“I called please call me back.” The tolls between Cohen and Pecker do not show a telephone call 
between 8:54 a.m. and 9:06 a.m. However, based on my review of text messages, I have learned 
that Cohen and Pecker communicate with each other over Signal, which is an encrypted 
communications cellphone application that allows users to send encrypted text messages and make 
encrypted calls. 

b. At 9:23 a.m., Cohen sent an email that stated “call me” to a banker at First Republic 
Bank (“First Republic Employee-2”). The email attached documents from the Secretary of State 
of Delaware indicating that Cohen had formed a limited liability company called “Resolution 
Consultants LLC” on September 30, 2016. As noted above, “Resolution Consultants” is the name 
of the entity that Cohen had told Howard he had formed recently after Howard said Davidson 
would “do it.” At 10:44 a.m., Cohen called First Republic Employee-2 and told him, in sum and 
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substance, that he needed an account in the name of “Resolution Consultants” opened immediately, 
and that he did not want an address on the checks written out of the account. Later that day, another 
employee at First Republic emailed Cohen account opening paperwork to complete. Cohen 
returned the account opening documents partially completed, but failed to provide a copy of his 
driver’s license or passport, and did not respond to the employee’s question of how he wanted to 
fund the account. As a result, the account was never opened. 

c. On October 17,2016, Cohen incorporated Essential Consultants LLC in Delaware. 
That same day, he filed paperwork to dissolve Resolution Consultants LLC. 

20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen 
and Davidson was not progressing sufficiently fast enough for Davidson or his client, Clifford, 
and they threatened to go public with Clifford’s allegations just days before the presidential 
election. Specifically, based on my review of toll records, information obtained pursuant to the 
iCloud Warrant, and public sources, I know the following: 

a. According to an article in The Washington Post , which quoted emails sent from 
Cohen’s email account hosted by the Trump Organization, on October 17,2016, Davidson emailed 
Cohen and threatened to cancel the aforementioned “settlement agreement” by the end of the day 
if Cohen did not complete the transaction. 10 According to the article, Davidson sent Cohen a 
second email later in the day that stated in part, “Please be advised that my client deems her 
settlement agreement canceled and void.” At 4:00 p.m. that day, Cohen called Davidson and they 
spoke for over five minutes. 


10 Due to the partially covert nature of the investigation to this date, the Government has not 
requested documents from the Trump Organization or Davidson, and thus does not possess the 
email referenced in this article. 
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b. Cohen’s 4:00 p.m. call with Davidson and/or Davidson’s threats to cancel the 
“settlement agreement” appear to have touched off a flurry of communications about the settlement 
agreement and whether Clifford would go public. Specifically: 

i. At 4:43 p.m., Howard sent Cohen a text message that stated: “I’m told 
they’re going with DailyMail. Are you aware?” One minute later, Cohen responded: “Call me.” 
Based on my involvement in this investigation, I understand Howard’s text to mean that he heard 
that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a 
tabloid newspaper. 

ii. At 4:45 p.m., Howard called Cohen and they spoke for over two minutes. 
Moments later, Davidson and Cohen spoke for about two minutes. 

iii. At 5:03 p.m., Cohen attempted to call Trump, but the call only lasted eight 
seconds. This was Cohen’s first call after he spoke with Davidson. 

iv. At 5:25 p.m., Cohen texted Howard, stating: “Well???” 

v. At 6:44 p.m., Howard responded to Cohen’s text, stating: “Not taking my 
calls.” Cohen responded one minute later: “You’re kidding. Who are you trying to reach?” 
Howard responded one min ute later: “The ‘agent.’” Based on my involvement in this 
investigation, I understand Howard’s text messages to mean that he attempted to contact Davidson 
about the matter involving Clifford, but that Davidson was not taking Howard’s calls. 

vi. At 6:49 p.m., Cohen called Howard and they spoke for nearly four minutes. 

c. The following day, on October 18, 2016, TheSmokingGun.com, a website that 
publishes legal documents and mugshots, published an article called: “Donald Trump and the Pom 
Superstar,” which alleged that Tramp had an extramarital affair with Clifford. However, the 
article noted that Clifford had declined to comment. 
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21. On or about October 25, 2016, the communications between Cohen, Davidson, 
Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. 
Specifically, based on my review of toll records, information obtained pursuant to the Cohen Email 
Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: 

a. On October 25, 2016, at 6:09 p.m., Howard sent Cohen a text message stating: 
“Keith calling you urgently. We have to coordinate something on the matter he’s calling you about 
or its [sic] could look awfully bad for everyone.” One minute later, Davidson sent Cohen a text 
message stating “Call me.” Cohen and Davidson called each other several times over the next half 
hour but appear not to have connected. At 6:42 p.m., Cohen and Davidson spoke for about eight 
minutes. At 7:11 p.m., they spoke for another two minutes. 

b. The next morning, on or about October 26,2016, at 8:26 a.m., Cohen called Trump 
and spoke to him for approximately three minutes. At 8:34 a.m., Cohen called Trump again and 
connected for a minute and a half. 

c. At approximately 9:04 a.m.—less than thirty minutes after speaking with Trump— 
Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential 
Consultants for him , and stated “can you send me asap the filing receipt” and then, in the second 
email, “for Essential Consultants LLC.” That person responded with the filing receipt two minutes 
later at 9:06 a.m. and with the certification of formation 23 minutes later, at 9:27 a.m. 

d. Shortly after that, Cohen contacted First Republic Employee-2 and told him, in sum 
and substance, that he decided not to open an account in the name of “Resolution Consulting” and 
instead would be opening a real estate consulting company in the name of “Essential Consultants.” 
Cohen told First Republic Employee-2 that he was at Trump Tower, and wanted to go to a First 
Republic branch across the street to open the account, so First Republic Employee-2 called, a 
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preferred banker at that branch (“First Republic Employee-1”), to assist Cohen. At 11:00 a.m., 
First Republic Employee-1 called Cohen. I know from my participation in an interview with First 
Republic Employee-1, that around the time of the call he went to Cohen’s office in Trump Tower— 
on the same floor as the Trump Organization—and went through account opening questions, 
including know your customer questions, with Cohen. In response to a series of know-your- 
customer questions about the purpose of the account—the answers to which First Republic 
Employee-1 entered into a form—Cohen stated, in sum and substance, that he was opening 
Essential Consultants as a real estate consulting company to collect fees for investment consulting 
work, and all of his consulting clients would be domestic individuals based in the United States. 
Based on my review of records obtained from First Republic, it appears that this account (the 
“Essential Consultants Account”) was created at a time between 11:00 a.m. and 1:00 p.m. 

e. At 1:47 p.m., Cohen called Davidson and they spoke for approximately two 
minutes. At approximately 1:49 p.m., Davidson emailed Cohen wiring instructions for an attorney 
client trust account at City National Bank. 

f. After the Essential Consultants Account was opened on October 26, 2016, Cohen 
transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the 
Essential Consultants Account. Following the transfer, at approximately 4:15 p.m. on October 26, 
2016, First Republic Employee-2’s assistant emailed Cohen at his Trump Organization email 
address to tell him that the funds had been deposited into the Essential Consultants Account. 
Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. 

g. At 6:37 p.m., Cohen asked Pecker by text message, “Can we speak? Important.” 
Cohen called Pecker at 6:49 p.m. and connected for thirty seconds. At 6:57 p.m., Cohen sent 
Howard a text message, stating: “Please call me. Important.” Cohen called Howard at 7:00 p.m. 
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and connected for about thirty seconds. At 7:06 p.m., Cohen called Pecker ^again and they spoke 
for nearly thirteen minutes. At 7:24 p.m., Howard sent a text message to Cohen that: “He said 
he’d call me back in 20 minutes. I told him what you are asldng for his [sic] reasonable. I’ll get 
it sorted.” Approximately an hour later, at 8:23 p.m., Howard told Cohen by text message to 
“check your Gmail for email from my private account.” In an email sent at 8:23 p.m. by Howard 
to Cohen and Davidson, with the subject line “Confirmation,” Howard stated, “Thank you both 
for chatting with me earlier. Confirming agreement on: - Executed agreement, hand-signed by 
Keith’s client and returned via overnight or same-day FedEx to Michael, - Change of agreement 
to reflect the correct LLC, - Transfer of funds on Thursday AM to be held in escrow until receipt 
of agreement.” After receiving that email, at approximately 8:27 p.m., Cohen asked Howard by 
text message, “Can you and David [Pecker] give me a call.” Howard promptly responded: “David 
is not around I think. I’ll call.” At 8:28 p.m., Howard called Cohen and they spoke for three 
minutes. 

22. On October 27, 2016, Cohen made a payment to Davidson of $130,000—with the 
funds intended for Clifford—for the purpose of securing her ongoing silence with respect to the 
allegations that she had an extramarital affair with Trump. Specifically, based on my review of 
toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen 
Email Warrants, I have learned the following: 

a. At 9:47 a.m., Cohen sent Davidson an email, stating: “Keith, kindly confirm that 
the wire received today, October 27, 2016 shall be held by you in your attorney’s trust account 
until such time as directed for release by me, in writing. Additionally, please ensure that all 
paperwork contains the correct name of Essential Consultants LLC. I thank you in advance for 
your assistance and look forward to hearing from you later.” 
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b. At approximately 10:01 a.m., according to records provided by First Republic 
Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account— 
which had been funded a day prior from Cohen’s home equity line of credit—to the attorney client 
trust account at City National Bank that Davidson had specified in the wiring instructions he sent 
to Cohen. The wire transfer was made shortly thereafter. 

c. At 10:02 a.m., Davidson responded to Cohen’s email from 9:47 a.m., stating: “I 
confirm that I will work in good faith & that no fluids shall be disbursed unless & until the plaintiff 
personally signs all necessary settlement paperwork, (the form of which will match the prior 
agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). 
Plaintiffs signature will be notarized and returned to you via FedEx. Only after you receive FedEx 
will I disburse. Fair?” 

d. At 10:50 a.m., First Republic Employee-1 sent Cohen an email confirming that the 
payment had been sent and providing him with the wire number. 

23. On October 28, 2016, and the days that followed, Cohen finalized the transaction 
with Davidson. Specifically, based on my review of toll records, information obtained pursuant 
to the iCloud Warrant, public sources, and bank records, I know the following: 

a. On October 28,2016, at 11:48 a.m., Cohen spoke to Trump for approximately five 
minutes. Beginning at 1:21 p.m., Cohen attempted a series of phone calls to Davidson, Pecker, 
and Howard throughout the day, although it appears he may only have connected with Howard. 

b. Later that day, at approximately 7:01 p.m., Davidson stated to Cohen by text 
message that “all is AOK. I should have signed, notarized docs on Monday. You should have 
them on Tuesday.” Cohen thanked him and said “I hope we are good.” Davidson responded, “I 
assure you. We are very good.” Howard also texted Cohen at 7:08 p.m., “Keith [Davidson] says 
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we are good.” Cohen then responded “OK” to Howard and “Excellent” to Davidson. At 
approximately 10:30 p.m., Cohen spoke to Hicks for three minutes. 

c. On October 31, 2016, Cohen called Howard at 8:22 p.m. and they spoke for over 
three minutes. At 8:32 p.m., Cohen received text messages from both Howard and Davidson. 
Howard said: “You’ll have paperwork tomorrow says KD.” Davidson said: “We are AOK. You 
will be receiving a package tomorrow.” Cohen responded “Thank you” to Howard and “Thanks 
Keith. Will call you then” to Davidson. From my involvement in this investigation, I believe 
Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would 
receive a package. 

d. Based on my review of court filings that became public in 2018,1 have learned that 
on or about October 28, 2016, “EC, LLC and/or David Dennison” entered into a “confidential 
settlement agreement and mutual release” with “Peggy Peterson,” pursuant to which “Peterson” 
agreed not to disclose certain “confidential information pertaining to [Dennison]” in exchange for 
$130,000. The agreement provided that “EC, LLC” would wire the funds to “Peterson’s” attorney, 
who would then transfer funds to “Peterson.” Cohen signed the agreement on behalf of “EC, 
LLC.” The agreement stated that the address for “EC, LLC,” which was later referred to in the 
agreement as “Essential Consultants, LLC,” was Cohen’s residence. 

e. Consistent with the “confidential settlement agreement and mutual release,” on or 
about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at 
City National Bank to a bank account in Clifford’s name. The wire had the annotation “net 
settlement.” On the same day, at approximately 9:48 a.m. Davidson sent Cohen a text message 
with a picture of a FedEx delivery confirmation, stating that at approximately 9:09 a.m. a package 
shipped by Davidson the previous day had arrived for Cohen at his Trump Organization 
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address. On the same day, at approximately 6:14 p.m., Davidson sent Cohen an email with an 
audio file attached and said “Give this a lesson [sic] and then call me.” The audio attachment was 
titled “Stormy.mp3” and was a five-minute recording of Davidson interviewing Clifford about 
recent public allegations made by an adult film star named Jessica Drake regarding her alleged 
past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake 
was not credible. Less than an hour later, at approximately 7:05 p.m., Cohen called Trump, but it 
appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne 
Conway, who at the time was Trump’s campaign manager. They did not connect. At 
approximately 7:44 p.m., however, Cohen received a return call from Conway, which lasted for 
approximately six minutes. 

24. On November 4, 2016, just three days after the Clifford transaction was completed 
and just four days before the presidential election, the Wall Street Journal published an article 
alleging that the National Enquirer had “Shielded Donald Trump” from allegations by Playboy 
model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed 
to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. 
Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants 
and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, 
Howard, Pecker, and Hicks around the time of this article’s publication—just days before Election 
Day—about the importance of preventing the McDougal and Clifford stories from gaining national 
traction. Specifically, I have learned the following: 

a. Between 4:30 and 8:00 p.m. on November 4, Cohen communicated several times 
with Howard, Pecker and Davidson. For instance, at approximately 4:49 p.m., Cohen sent Howard 
a text message with a screenshot of an email forwarded to him by another Trump Organization 
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lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment 
from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, 
including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at 
approximately 7:33 p.m., using two different cellphones subscribed to him, Cohen appears to have 
been talking to Davidson and Hicks at the same time. 

b. At approximately 8:51 p.m., Cohen sent Howard a message, stating: “She’s being 
really difficult with giving Keith a statement. Basically went into hiding and unreachable.” One 
minute later, Howard responded: “I’ll ask him again. We just need her to disappear.” Cohen 
responded, “She definitely disappeared but refuses to give a statement and Keith cannot push her.” 
At approximately 8:55 p.m., Howard responded to Cohen’s text: “Let’s let the dust settle. We don’t 
want to push her over the edge. She’s on side at present and we have a solid position and a plausible 
position that she is rightfully employed as a columnist.” Based on my involvement in this 
investigation, I believe Cohen and Howard were referring to Karen McDougal when they were 
discussing “she” and “her.” Additionally, I believe Howard’s statement that “we have ... a 
plausible position that she is rightfully employed as a columnist” was a reference to the fact that 
AMI had given McDougal payments for her role as a purported columnist for the company. 

c. At approximately 8:58 p.m. on November 4, 2016, Howard attempted to reassure 
Cohen about the effect of the forthcoming Wall Street Journal article, texting, “I think it’ll be ok 
pal. I think it’ll fade into the distance.” Cohen responded, “He’s pissed.” Howard wrote back, 
“I’m pissed! You’re pissed. Pecker is pissed. Keith is pissed. Not much we can do.” Based on 
my involvement in this investigation, I believe Cohen was referring to Trump when he stated “he’s 
pissed.” Cohen asked Howard at approximately 9:00 p.m. how the Wall Street Journal could 
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publish its article if “everyone denies.” Howard responded, “Because there is the payment from 
AMI. It looks suspicious at best.” 

d. At approximately 9:03 p.m., Hicks called Cohen and they spoke for two minutes. 
At approximately 9:11 p.m., Cohen called Howard and spoke to him for five minutes. At 
approximately 9:15 p.m., Hicks called Cohen and they spoke for nearly seven minutes. Again, 
Cohen used different phones for these two calls, such that he appears to have been on both calls 
for about a minute of overlap. At approximately 9:32 p.m., Cohen texted Pecker, “The boss just 
tried calling you. Are you free?” A minute later, Cohen texted Howard, “Is there a way to find 
David quickly?” 

e. At approximately 9:50 p.m., the Wall Street Journal article was published online. 
Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen 
and Howard exchanged several text messages commenting on how the story came across. The next 
morning onNovember 5,2016, at approximately 7:35 a.m., Cohen texted Hicks, “So far I see only 
6 stories. Getting little to no traction.” Hides responded, “Same. Keep praying!! It’s working!” 
Cohen wrote back, “Even CNN not talking about it. No one believes it and if necessary, I have a 
statement by Storm denying everything and contradicting the other pom stars statement. I wouldn’t 
use it now or even discuss with him as no one is talking about this or cares!” Based on my 
involvement in this investigation, I believe Cohen was referring to the above-referenced recorded 
audio statement by Clifford that he obtained from Davidson, and was stating that such a statement 
could be used to influence potential negative media relating to Trump, but was unnecessary at that 
time. Based on a text message from Hicks to Cohen, I believe that later that morning, Pecker 
spoke to Tmmp. 


23 






Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 28 of 80 


25. On or about November 8, 2016, Trump won the election for President of the United 

States. 

26. On or about January 12, 2018, the Wall Street Journal first reported that Cohen 
arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government 
watchdog group, filed a complaint with the Federal Election Commission, alleging that Cohen had 
violated campaign finance laws by making the payment to Clifford. Based on my review public 
sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I 


have learned the following: 

a. On or about January 23, 2018, the day after Common Cause filed its complaint, 

Cohen began emailing himself drafts of statements describing his payment to Clifford. 

Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an 

individual who appears to be writing a book on Cohen’s behalf: 

In October 2016,1 was contacted by counsel for Ms. Clifford stating that 
news outlets, including ABC news, were pursuing the 2011 story of an 
alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that 
both parties had already denied the allegation, as Mr. Trump’s longtime 
special counsel and protector, I took it upon myself to match the offer and 
keep the story from hrealdng. I knew the allegation to be false, but I am 
also a realist who understands that just because something is false doesn ’t 
mean that it doesn’t create harm and damage. I could not allow this to 
occur. I negotiated a non-disclosure agreement with Ms. Clifford’s 
counsel and tendered the funds. I did this through my Delaware LLC and 
transferred personal funds to cover the agreement. I was not reimbursed 
any monies from Mr. Trump, the Trump Organization, any third party or 
the Presidential campaign. At no point did I ever advise Mr. Trump of my 
communications or actions regarding this agreement. As outlandish and 
unusual as this may appear, the Trumps have been like family to me for 
over a decade. It’s what you do for family. 

(Emphasis added.) Based on my involvement in this investigation, I believe that the above email 
is an acknowledgement that the allegation of the affair had existed for some time ( u ...the 2011 
story.. .”), but that Cohen was motivated to “keep the story from breaking” again in October 2016. 
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b. On or about February 13, 2018, Cohen said in a statement to The New York Times 

| 

\ 

that “Neither the Trump Organization nor the Trump campaign was a party to the transaction with 
Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a 
campaign expenditure by anyone.” Cohen declined to answer follow-up questions including 
whether Trump had been aware of the payment, why Cohen made the payment, or whether similar 
payments had been made to other people. 

c. On or about February 14, 2018, Cohen was asked by The New York Times whether 
Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the 

1 

, . t 

payment, or whether he had made payments to other women. Cohen stated m response, “I can’t 
get into any of that.” On or about February 14, 2018, Cohen also stated to The Washington Post 
that: “In a private transaction in 2016, I used my own personal funds to facilitate a payment of 

I 

$130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign 
was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either 
directly or indirectly.” 

d. On or about March 9, 2018, Cohen stated to ABC News that “the funds were taken 
from my home equity line and transferred internally to my LLC account in the same bank.” 

27. Accordingly, for the foregoing reasons, there is probable cause to believe that 
Cohen committed violations of the Subject Offense by making an in-kind contribution to Trump 
or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. 

Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has 

admitted that he paid $130,000 of his “personal funds” to Clifford and that the payment occurred 

less than two weeks before the election, as Trump was facing negative media allegations about 

his behavior toward women, even though allegations of an affair between Trump and Clifford | 


25 



Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 30 of 80 


existed since 2011. In addition, the communication records set forth above make evident that 
Cohen communicated with members of the Trump campaign about his negotiation with 
Clifford’s attorney and the need to preclude Clifford from making a statement that would have 
reflected negatively on the candidate in advance of the forthcoming election. 

28. Therefore, there is probable cause to believe that a search of the Subject Devices 
will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: 

a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or 
their agents or legal representatives, including any nondisclosure agreements and related 
documents, and any co mm unications related to such agreements. 

b. Evidence of communications involving Michael Cohen, Donald Trump 
and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, 
or payments to Stephanie Clifford or Karen McDougal. 

c. Evidence of communications with American Media, Inc., David Pecker, 
and/or Dylan Howard about Donald Tmmp, the Trump Campaign, Stephanie Clifford, and/or 
Karen McDougal. 

d. Evidence relating to Cohen’s role in the Trump Campaign, and coordination 
or consultation with the Tmmp Campaign. 

e. Evidence of communications with Donald Trump and/or agents or 
associates of the Tmmp Campaign about the Access Hollywood tape. 

f. Evidence relating to Cohen’s knowledge of the campaign finance laws, 
campaign contribution reporting requirements, and campaign contribution limits. 
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g. Evidence indicating Michael Cohen’s intent with respect to the Subject 
Offense, including whether the payment to Clifford and any similar payments were made to 
influence the Presidential election. 

III. Procedures for Searching ESI 
A. Review of ESI 

29. Law enforcement personnel (including, in addition to law enforcement officers and 
agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, interpreters, and outside vendors or technical experts under 
government control) will review the ESI contained on the Subject Devices for information 
responsive to the warrant. 

30. In conducting this review, law enforcement personnel may use various methods to 
locate evidence, fruits, and instrumentalities of the Subject Offense, including but not limited to 
undertaking a cursory inspection of all emails, texts or files contained on the Suhj ect Devices. This 
method is analogous to cursorily inspecting all the files in a file cabinet in an office to determine 
which paper evidence is subject to seizure. Although law enforcement personnel may use other 
methods as well, particularly including keyword searches, I know that keyword searches and 
similar methods are typically inadequate to detect all information subject to seizure. As an initial 
matter, keyword searches work only for text data, yet many types of files commonly associated 
with emails, including attachments such as scanned documents, pictures, and videos, do not store 
data as searchable text. Moreover, even as to text data,, keyword searches cannot be relied upon 
to capture all relevant communications in an account, as it is impossible to know in advance all of 
the unique words or phrases that investigative subjects will use in their communications, and 
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consequently there are often many communications in an account that are relevant to an 
investigation but that do not contain any keywords that an agent is likely to search for. 

IV. Conclusion and Ancillary Provisions 

31. Based on the foregoing, I respectfully request the court to issue a warrant to seize 
the items and information specified in Attachment A to this affidavit and to the Search and Seizure 
Warrant. 

32. In light of the confidential nature of the continuing investigation, and for the 
reasons more fully set forth in the Accompanying Affidavit, I respectfully request that this affidavit 
and all papers submitted herewith be maintained under seal until the Court orders otherwise. 



Special Agent, US AO 


Sworn to before me on 


7th day of April, 201.8 j t ,. 


HON. HENRY. B< PITMAN . ; 
UNITED STATES MAGISTRATE JUDGE 



< 
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Attachment A 

I. Devices to be Searched 

The devices to be searched (the “Subject Devices”) are described as: 

a. Subject Device-1 : A black and red USB drive with a white label that says “Tracking 
#: 180208140208.” 

b. Subject Device-2: A silver DVD with a white label that reads “Cohen — 
2018.03.07.” 

c. Subject Device-3: A white DVD labelled “2-28-18 Cohen SW Returns — Google 

and l&l.”....- 


II. Review of ESI on the Subject Devices 

Law enforcement personnel (including, in addition to law enforcement officers and agents, 
and depending on the nature of the ESI and the status of the investigation and related proceedings, 
attorneys for the government, attorney support staff, agency personnel assisting the government in 
this investigation, interpreters, and outside vendors or technical experts under government control) 
are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and 
instrumentalities of one or more violations of 52 U.S.C. §§ 30116(a)(1)(A) and 30109(d)(l)(A)(l) 
(illegal campaign contributions) (the “Subject Offense”), as listed below: 

a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their 
agents or legal representatives, including any nondisclosure agreements and related 
documents, and any communications related to such agreements. 

b. Evidence of communications involving Michael Cohen, Donald Trump and/or 
agents or associates of the Trump Campaign about Stephanie Clifford or Karen 
McDougal, or payments to Stephanie Clifford or Karen McDougal. 

c. Evidence of communications with American Media, Inc., David Pecker, and/or 
Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, 
and/or Karen McDougal. 

d. Evidence relating to Cohen’s role in the Trump Campaign, and coordination or 
consultation with the Trump Campaign. 
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e. Evidence of communications with Donald Trump and/or agents or associates of the 
Trump Campaign about the Access Hollywood tape. 

f. Evidence relating to Cohen’s knowledge of the campaign finance laws, campaign 
contribution reporting requirements, and campaign contribution limits. 

g. Evidence indicating Michael Cohen’s intent with respect to the Subject Offense, 
including whether the payment to Clifford and any similar payments were made to 
influence the Presidential election. 


2 






Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 35 of 80 


Exhibit A 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


filed 

JUL 21 m 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATIO N ASSOCIATED WITH THE EMAIL 
ACCOUNT^^^^^KftGMAlLCOM 


rase- v 17 - rn)-00503 

tola^To'Hwe^erylA. 

S^eTch and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 




To:-Anyauthorized-law-enforcement-office r - . . .-. . .■ ■ . - . - . - 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of _ California 

(identify the person or describe the property to be searched and give its location)l 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before Augu st 1, 2017 ___ (not to exceed 14 days) 

5^ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to ^ Hon, Beryl A. Howell , . 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C* 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of ._ , __, 

Date and time issued: / jy _ 

/ * Judge s signature 

City and state: Washington, DC Hon. Beryl A. Howell, Chief LLS. District Judge 

Printed name and title 
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AO 93 (Rev 11/13) Search and Seizure Warrant (Page 2) 


Return 


Case No.: 


Date and tfnp warrant executed: 


inventory made in the presence of ’: 


Copy of warrant and inventory left with: 

G~oo UgJ -1~> x S7 


Inventory of the property taken and name of any person(s) seized: 

Qr«,M F,Ls •. \isa>oe^ 


j \cT£>£>S c I' 7'Onc>7\q~ ) 

■A ^ t>r I* 

^ Prod^4r.-, F.Lsr 


FILED 

JUL 21 2017 

Clerk, u.S. District and 
Bankruptcy Courts 


Certifies! tion 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Dale: 


: fnon&o 



Pruned name and line 
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ATTACHMENT A 


This warrant applies to information associated with the Google Mail Account 
@gmail.com that is stored at premises owned, maintained, controlled, or operated by 
Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 



1 
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ATTACHMENT B 


I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Google (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
■session times and dates, account status, alternative e-mail addresses provided 


2 






Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 40 of 80 


during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 

f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and. 

k. AH telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 101.4 (false statements to a financial 
institution) and 18 U.S.C. § 1956 (money laundering), as well as 18 U.S.C. § 951 (acting as an 
unregistered foreign agent) and the Foreign Agents Registration Act (“FARA”), 22 U.S.C. § 611 
etseq., involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for 
each account or identifier listed on Attachment A, information pertaining to the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files involving Bo and Abe Realty, 
LLC; 

c. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
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account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 

d. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 

| 

or on behalf of, any foreign government, foreign officials, foreign entities, foreign 

1 

persons, or foreign principals; 

e. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 

I 

..._foreign principals; _______J 

f. Evidence indicating how and when the account was accessed or used, to determine | 

the geographic and chronological context of account access, use, and events relating 

to the crimes under investigation and to the account owner; 

g. Evidence indicating the account owner’s-state of mind as it relates to the crimes 
under investigation; 

h. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); and 

i. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 
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Exhibit B 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

Case: 1:17-mj-00855 
Assigned To : Chief Judge Howell, Beryl A. 
Assign. Date : 11/13/2017 
Description: Search and Seizure Warrant 

SEARCH AND SEIZURE WARRANT 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH THE EMAIL ) 

ACCOUNT IgMAIL.COM .) 

) 


-To : A ny authorized law enforcement- officer 


An application by a federal law enforcement officer or ah attorney for the government requests the search 
of the following person or property located in the _ Northern District of California I 

(identify the person or describe the property to be searched and give its location)l 


See Attachment A. 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before November 20, 2017 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell _. 

(United States Magistrate Judge) 


□ Pursuant to 18 U.S.C. .§ 3103a(b), I find that immediate notification may have m adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for__days (not to exceed JO) □ until, the facts justifying,the later specific date of _ 


Date and time issued: 






City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. I l/l 3) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


: ‘Certification 

I declare under penalty qf perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date:__ . _ 

Executing officer '$ signature 


Printed name and title 
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ATTACHMENT A 


This wari’ant applies to information associated with the Google Mail Account 
ggmail.com that is stored at premises owned, maintained, controlled, or operated 
by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, 


1 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, Or control of the Google (hereinafter “the Provider”)} regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, fdes, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

a. The contents of al 1 emailsdssociated witHThe account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. AH records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods Of connecting; 
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f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a.login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 
-——— addresses, Electronic-Serial—Numbers (“ESN”-),—Mobile—Electronic—Identity- 

Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules ("SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (‘‘IMSP’), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution), 18 U.S.C, § 1343 (wire fraud), 18 U.S.C, § 1344 (bank fraud), and 18 U.S.C. § 1956 
(money laundering), as well as 18 U.S.C. § 951 (acting as an unregistered foreign agent) and the 
Foreign Agents Registration Act (“FARA”), 22 U.S.C, § 611 et seq., involving Michael Dean 
Cohen and occurring On or after June 1, 2015, including, for each account or identifier listed on 
Attachment A, Information pertaining to the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files that false representations to. a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 
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c. 


d. 


e. 


Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 

Evidence indicating how and when the account was accessed or used, to determine 


the geographic and.ehronological context of account access,.use, 


a nd events relatin g 


to the crimes under investigation and to the account owner; 

f. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

g. The identity of the person(s) who created or used the account/including records 
that help reveal the whereabouts of such person(s); and 

h. The identity of any person(s)—Including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, of foreign principals, 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “fitter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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Exhibit C 
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AG -93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 

(Briefly describe the properly to be. searched 
or identify the person by name and address) 


.INFOR MATION ASSOCIAT ED WITH THE ACCOUNT 
■ WHICH IS STORED AT THE 

-PREMISES OF 1&1 INTERNET, INC. 


) 

) 

) 

) 

) 

) 


Case: l;17-mj-00854 

Assigned To : Chief Judge Howell, Beryl A. 

Assign, Date: 11/13/2017 

Description: Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


-To:-Any authorized law enforcement officer-————^----—-— 

An .application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location ft 


See Attachment A. 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B. 


f 


: 


I 

j! 

. 

I 


I 

! 

l 


I 


YOU ARE COMMANDED to execute this warrant on or before 


November 20, 2017 


^ (not to exceed 14 days) 


in the daytime 6:00 a.m. to 10:00 pun. D at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt, for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell . 


(United States Magistrate Judge) 

□ Pursuant to 18 U.S.G. § 3l03a(b), I find that .immediate notification may have an adverse result listed in 18 U.3.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

P for_days (not to exceed 30) □ until, the facts justifying, the later specific date of __ 


Date- and time issued: /// / Y 

City and state: Washington, DC 


Judge V signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No,: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 



Certification 


1 declare under penalty of perjury that this inventory' is correct and was returned along with the 'original warrant to the 
designated judge, 


Date: 


Executing officer's signature 


Printed name find title 
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ATTACHMENT A 


This warrant applies to information associated with the email 



is stored at premises owned, maintained, controlled, or operated by l&l Internet, Inc. (“l&l”), an 
electronic communication and/or remote computing service provider headquartered in Sunnyvale, 
California. 


1 
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ATTACHMENT B 

I. Information to be disclosed by l&l 

To the extent that the information, described in Attachment A is within the possession, 
custody, or control of the l&l (hereinafter “the Provider”), regardless of whether such information 
is stored, held or maintained inside or outside of the United States* and including tiny emails, 
records, flies, logs, or information that have been deleted but are still available to the Provider, the 
Provider is required to disclose the following information to the government for each account or 
identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means arid 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times arid dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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fi All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address of browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 

_1_addresses, Electronic Serial Numbe rs (“E SN ,? ), Mobile Electronic Identity 

Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers ("MIN”), Subscriber Identity Modules ("SIM”), Mobile Subscriber 
Integrated Services Digital Network Number ("MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”), 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.G. § 1014 (false statements to a financial 
institution), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1344 (bank fraud), and 18 U.S.C. § 1956 
(money laundering), as well as 18 U.S.C. § 951 (acting as ah unregistered foreign agent) and the 
Foreign Agents Registration Act (“FARA”), 22 U.S.C. § 611 et seq., involving Michael Dean 
Cohen, including, for each account or identifier listed on Attachment A, information pertaining to 
the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account Or loan at 
that financial institution; the nature of any business or entity associated with an 
account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 
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c. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

d. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

e. Evidence indicating how and when the account was accessed or used, to determine 

----—the geographidand chronologicaf context of account access, use, and events relating 

to the crimes under investigation and to the account owner; 

f. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

g. ■ The identity of the person(s) who created or used the account, including records 

that help reveal the whereabouts of such person(s); and 

h. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—-who communicated with the account about any matters relating 
to activities conducted by Michael Dean Coheh on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals, 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent wilh 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 


4 
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AO 93 (Rev, 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of .) 

(Briefly describe (he property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH THE APPLE ID ) 
5JGMAIL.COM THAT IS STORED AT ) 
PREMISES CONTROLLED BY APPLE, INC. ) 


ase: 17-mj-00570 

ssigned To : Howell, Beryl A, 

ssiqn Date 8/7/2017 

escription: Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney tor the government requests the search 

of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)' 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B, 


YOU ARE COMMANDED to execute this warrant on or before August 21, 2 Q 17 . ( not to exceed 14 days) 

gf in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to____ __JiPJT . Bef ^ H° we ^. ..... * 

(United Stales Magistrate Judge) 


. □ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed30) O until, the facts justifying, the later specific date of_,_ • _ 



City and state: Washington, DC 


Hon, Beryl A. Howell, Chief U.S. District Judge 
Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Case No.: 


Return 


Date and time warrant executed: 


Copy of warrant and inventory left with: 


Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 

This warrant applies to information associated with the Apple ID 
a^gmail.com that is stored at premises owned, maintained, controlled, or operated 
by Apple, Inc. (“Apple”), a company headquartered at 1 Infinite Loop, Cupertino, CA 95014. 
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ATTACHMENT B 

I. Information to be disclosed by Apple, Inc. 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, Inc. (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
acc oun t or identifier listed in Attachment A: ________ 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
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during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 

f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 

—_—;-and-— : -———— - . - 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”). Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution), 18 U.S.C. § 1344 (bank fraud), 18 U.S.C. § 1956 (money laundering), 18 U.S.C. §951 
(acting as an unregistered foreign agent), and 22 U.S.C. § 611 et seq. (Foreign Agents Registration 
Act), involving Michael Dean Cohen and occurring on or after January 1,2016, including, for each 
account or identifier listed on Attachment A, information pertaining to the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files involving Bo and Abe Realty, 
LLC; 

c. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
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account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 

d. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

e. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 

—_—foreign principals;-■--—— •-— 

f. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

g. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

h. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); and 

i. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)-—who commun icated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 
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Exhibit E 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


El the Matter of a Warrant for All 
Content and Other Information 
Associated w ith the Email Accounts 
§)gmail.com, . 
|@gmail.com, and 

Maintained at 
Premises Controlled by Google, Inc., 
US AO Reference No. 2018R00127 




Search Warrant and Non-Disclosure Order 

TO: Google, Inc, (“Provider”) 


United States Attorney’s Office for the Southern District of New York and the Federal 
Bureau of Investigation (collectively, the “Investigative Agencies”) 

United States 

Attorney’s Office for the Southern District of New York, and pursuant to the'provisions of the 
Stored Communications Act, 18 U.S.C. § 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
cause to believe the email accounts @gmail.com, S)gmail.com, and 

, maintained at premises controlled by Google, Inc., contain evidence, 
fruits, and instrumentalities of crime, all as specified in Attachments A and B hereto. Accordingly, 
the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date 
of service of this Warrant and Order, the records specified in Section II of Attachments A and B 
hereto, for subsequent review by law enforcement personnel as authorized in Sections III and IV 
of Attachments A and B. The Government is required to serve a copy of this Warrant and Order 
on the Provider within 7 days of the date of issuance. The Warrant and Order may be served via 


1. Warrant. Upon an affidavit of Special Agent 
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electronic transmission or any other means through which the Provider is capable of accepting 
service. 

2. Non-Disclosure Order. Pursuant to 18 U.S.C. § 2705(b), the Court finds that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 
tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 
existence of this Warrant-arid' Order to the listed subscriberor to any other person-fora-period of 
180 days from the date of this Order, subject to extension upon application to the Court if 
necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider 
for the purpose of receiving legal advice. 


3. Sealing. It is further ordered that tins Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 


obligations in any prosecutions related to this matter. 


Dated: New York, New York 


UI S 


]o r M ( i4/^ 



Date Issued 


Time Iss”~ J 



Southern District^Yprk' 


02 . 28.2018 


2 
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Email Search Attachment A 
I. Subject Account and Execution of Warrant 

This warrant is directed to Google, Inc. (the “Provider”), headquartered at 1600 
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email account 
lilgmail.com (the “Subject Account”) for the time period referenced below. 

A law-enforcement- officer will-servefhis-warrant by transmitting-it-via email or-another- 


appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content. All emails sent to or horn, stored in draft form in, or otherwise 
associated with the Subject Account, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email) 
limited to items sent, received, or created between November 14,2017 and the date ofthis warrant, 
inclusive. 


b. Address book information. All address book, contact list, or similar information 
associated with the Subject Account 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Account, including but not limited to name, username, address, telephone 
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number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Account, 
including any IP logs or other records of session times and durations, limited to items sent, 
received, or created between December 1,2014 and the date of this warrant, inclusive. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with (lie Subject Account, including complaints, inquiries, or oilier contacts with support services 
and records of actions taken, limited to items sent, received, or created between December 1,2014 
and the date of this warrant, inclusive. 

f. Search History. All search history and/or web history associated with the Subject 
Account, limited to items sent, received, or created between December 1,2014 and the date ofthis 
warrant, inclusive. 

g. Associated content. All Google Docs, files maintained on Google Drive, and instant 
messages or Gchats associated with the Subject Account, limited to items sent, received, or created 
between December 1,2014 and the date of this warrant, inclusive. 

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(f) or otherwise. 

HI. Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities ofviolations of 18 U.S.C. §§ 371 (conspiracyto commit offense or to defraud 


02.2812018 


2 
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the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Account; 

b. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

c. Communications, recordsydocuments, and other files involving a pian, proposal^ or 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to others, including to and/or 

entities associated with him; 

d. Communications, records, documents, and other files involving Essential Consultants, 
T.T. C or Michael D. Cohen & Associates, including those which indicate the nature and purpose of 
payments made to or from Essential Consultants or Michael D. Cohen & Associates; 

e. Communications, records, documents, and other files necessary to establish the identity 

of any person(s) - including records that reveal the whereabouts of the person(s) — who 
communicated with the Subject Account about any matters relating to Essential Consultants, LLC, 
or about any plan or proposal or.agreement for Michael D. Cohen and/or entities associated with 
him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, 
including to j and/or entities associated with him; 

f. Communications between the Subject Account and Jeffrey Getzel relating to Michael 
D. Cohen’s bank accounts, taxes, debts, and/or finances; 

g. Communications, records, documents, and other files reflecting false representations 
•to a financial institution with relation to the intended purpose of an account or loan at that financial 


02.28.2018 


3 
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institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

h. Evidence indicating how and when the Subject Account was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; and 

i. Evidence indicating the Subject Account owner’s intent as it relates to the Subject 
Offenses under investigation. 

IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 


02.28.2018 


4 
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Email Search Attachment B 

I. Subject Account and Execution of Warrant 

This warrant is directed to Google, Inc. (the “Provider”), headquartered at 1600 
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email 
accounts |^^^|gmail.com and ^^^^|(the “Subject Accounts”) for the time 

period between-October- 1,-2016 and the-date-of-this warrant, inclusive-——-— 

A law enforcement officer will serve this warrant by transmitting it via email or another 
appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Accounts: 

a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Accounts, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address book information. All address book, contact list, or similar information 
associated with the Subject Accounts. 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Accounts, including but not limited to name, username, address, telephone 
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number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Accounts, 
including any IP logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 

with the Subject Accounts, including complaints, inquiries, or other contacts with support services 
and records of actions taken,--——-——— - 

f. Search History. All search history and/or web history associated with the Subject 
Accounts. 

g. Associated content. All Google Docs, files maintained on Google Drive, 'and instant 
messages or Gchats associated with the Subject Accounts. 

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(f) or otherwise. 

m. Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical, experts under government control) are 
-authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities of violations of 18U.S.C. §§ 371 (conspiracyto commit offense or to defraud 
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identify 
of the person(s) who created or used the Subject Accounts; 

2 

02.28.2018 
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b. Communications, records, documents, and other files involving a plan or proposal or 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to and/or entities associated 

with him; 

c. Communications, records, documents, and other files necessary to establish the identity 

of any person(s) — including records that reveal the whereabouts of the person(s) - who 
communicated - with the Subject Accounts about any matters relating-to any plan or proposal or 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to md/or entities associated 

with him; 

d. Communications between the Subject Accounts and others, including employees or 
representatives of Sterling National Bank, Melrose Credit Union, or other financial institution(s), 
regarding Michael D. Cohen’s finances; 

e. Co mmuni cations, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

f. Evidence indicating how and when the Subject Accounts was accessed or used, to 

determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; . . 

g. Evidence indicating the Subject Accounts owners’ intent as it relates to the Subject 
Offenses under investigation. 


02.28.2018 


3 
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IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 
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UNTIED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of a Warrant for All 
Content and Other Information 
Associated with the Email Account 
maintained at 

Premises Controlled by 1 & 1 Internet, 
Inc., USAO Reference No. 
2018R00127 


Search Warrant’ and Non-IHsciostre Order-— 

TO: 1 & 1 Internet, Inc. (“Provider”) 

United States Attorney’s Office for the Southern District of New York and the Federal 
Bureau of Investigation (collectively, the “Investigative Agencies”) 


1. Warrant. Upon an affidavit of Special Agent of the United States 

Attorney’s Office for the Southern District of New York, and pursuant to the provisions of the 


Stored Communications Act, 18 U.S.C. § 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
cause to believe the email account | naintained at premises controlled by 1 

& 1 Internet, Inc., contains evidence, fruits, and instrumentalities of crime, all as specified in 
Attachment D hereto. Accordingly, the Provider is hereby directed to provide to the Investigative 


Agencies, within 7 days of the date of service of this Warrant and Order, the records specified in 
Section II of Attachment D hereto, for subsequent review by law enforcement personnel as 
authorized in Sections III and IV of Attachment D. The Government is required to serve a copy 
of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant 
and Order may be served via electronic transmission or any other means through which the 
Provider is capable of accepting service. 
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2. Non-Disclosure Order. Pursuant to 18 U.S.C. § 2705(b), the Court finds that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 


tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 


existence of this Warrant and Order to the listed subscriber or to any other person for a period of 
180 days from the date of this Order, subject to extension upon application to the Court if 
necessaryyexceptthatProviderTxiay disclose this Warrant and Order-to an attomey-for-Provider 
for the purpose of receiving legal advice. 

3. Sealing. It is further ordered that this Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 
obligations in any prosecutions related to this matter. 

Dated: New York, New York 







Date Issued 


Time Isi 



02 . 28.2018 


2 













Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 77 of 80 



Email Search Attachment D 

I. Subject Account and Execution of Warrant 

This warrant is directed to 1 & 1 Internet, Inc. (the “Provider”), headquartered at 701 Lee 
Road, Suite 300, Chesterbrook, Pennsylvania 19087, and applies to all content and other 
information within the Provider 5 s possession, custody, or control associated with the email account 
(the “Subject Account”) for the time period between November 14, 2017 
and the date of this warrant, inclusive.-——--————-— 

A law enforcement officer will serve this warrant by transmitting it via email or another 
appropriate maimer to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent wi thin the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Account, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address hook information. All address book, contact list, or similar information 
associated with the Subject Account. 

c. Subscriber and payment information. All subscriber “and payment information 
regarding the Subject Account, including but not limited to name, username, address, telephone 
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number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Account, 
including any DP logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with the Subject Account, including complaints, inquiries, or other contacts with support services 
and recordsrofactions taken; ' 

f. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(f) or otherwise. 

IH. Review of Information by the Government 

Law enforcement p ers onnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities of violations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud 
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Account; 

b. Communications, records, documents, and other files' involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

c. Communications, records, documents, and other files involving a plan, proposal, or 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
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medallions, and any associated debts or liabilities, to others, including to 



ind/or 


entities associated with him; 

d. Communications, records, documents, and other files involving Essential Consultants, 
LLC or Michael D. Cohen & Associates, including those which indicate the nature and purpose of 
payments made to or from Essential Consultants or Michael D. Cohen & Associates; 


e. The identity of any person(s) - including records that reveal the whereabouts of the 


“person(s) — whomommunicated: withthrrSubject Account about any matters relating to Essential- 
Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/or entities 


associated with him to transfer any interest in taxi medallions, and any associated debts or 



and/or entities associated with him; 


liabilities, to others, including to 


f. Communications between the Subject Account and Jeffrey Getzel relating to Michael 
D. Cohen’s bank accounts, taxes, debts, and/or finances; 

g. Communications, records, documents, and other files reflecting false representations 
to a financial institution with-relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing irito an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

h. Evidence indicating how and when the Subject Account was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; and 

i. Evidence indicating the Subject Account owner’s intent as it relates to the Subject 
Offenses under investigation. 
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IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 
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